Technical Tip: How to send a reply in a TCL script from the FortiManager to a query from the FortiGate

When a TCL script is run from the FortiManager on a FortiGate, some commands send a query from the FortiGate. These queries mostly need a  reply  y/n, for example:

This operation will reboot the system !
Do you want to continue? (y/n)

In this case, the script needs to reply to this query to continue. To show what happens, the command execute reboot was used as it is a command that will reply with a query, and it is easy to verify.

  In the following script example, the first reply to the query is 'n', and the script continues, and then the reply is 'y', where the device will reboot. The example script was used on the FortiGate with vdoms enabled.

To enable Scripting, configure the following CLI settings on the FortiManager:

FMG # config system admin setting

(setting) set show_schedule_script enable
(setting) set show_automatic_script enable
(setting) set show_tcl_script enable
(setting) end

In the GUI, navigate to Device manager -> Scripts -> CLI/TCL script and select 'Create new'

Create a TCL script using the following text:

#!
proc do_cmd {cmd} {
puts [exec "$cmd\n" "# " 20]
}
######

do_cmd "config vdom" 
do_cmd "edit root"
do_cmd "config sys interface"
do_cmd "edit port2"
do_cmd "set vdom root"
do_cmd "set ip 3.2.2.2/32"
do_cmd "set allowaccess ping"
do_cmd "next"
do_cmd "end"
do_cmd "end"
do_cmd "config global"
do_cmd "get system status"
do_cmd "execute reboot"
do_cmd "n" 

## First reply n to the query

## This operation will reboot the system
## Do you want to continue? (y/n)

## The script continues to configure the device to show the response has taken affect ie no reboot
do_cmd "end"
do_cmd "config vdom"
do_cmd "edit root"
do_cmd {config system interface}
do_cmd {edit "Mytest"}
do_cmd {set vdom "root"}
do_cmd {set ip 192.168.7.1 255.255.255.0}
do_cmd {set allowaccess ping}
do_cmd "set interface port3"
do_cmd "set vlanid 111"
do_cmd "next"
do_cmd "end"
do_cmd "end"
do_cmd "config global"
do_cmd "get system status"
do_cmd "execute reboot"
do_cmd "y"

## when the reply is yes the FGT reboots

## This time the response  on the query is y 

##This operation will reboot the system
##Do you want to continue? (y/n)  

To verify the outcome of this script, navigate in the GUI to  System Settings -> Task Monitor, find the script, and View Script Execution History:

-------Executing time: Fri Oct 24 14:25:56 2025-----------

Starting log (Run on device)

config vdom

FGVM02TM22000891 (vdom) #
edit root
current vf=root:0

FGVM02TM22000891 (root) #
config sys interface

FGVM02TM22000891 (interface) #
edit port2

FGVM02TM22000891 (port2) #
set vdom root

FGVM02TM22000891 (port2) #
set ip 3.2.2.2/32

FGVM02TM22000891 (port2) #
set allowaccess ping

FGVM02TM22000891 (port2) #
next

FGVM02TM22000891 (interface) #
end

FGVM02TM22000891 (root) #
end

FGVM02TM22000891 #
config global

FGVM02TM22000891 (global) #
get system status
Version: FortiGate-VM64-KVM v7.2.10,build1706,240918 (GA.M)
.... Output was cut
Last reboot reason: warm reboot

FGVM02TM22000891 (global) #
execute reboot
This operation will reboot the system !
Do you want to continue? (y/n)
n^J

FGVM02TM22000891 (global) #
FGVM02TM22000891 (global) #
end

FGVM02TM22000891 #
config vdom

FGVM02TM22000891 (vdom) #
edit root
current vf=root:0

FGVM02TM22000891 (root) #
config system interface

FGVM02TM22000891 (interface) #
edit "Mytest"

FGVM02TM22000891 (Mytest) #
set vdom "root"

FGVM02TM22000891 (Mytest) #
set ip 192.168.7.1 255.255.255.0

FGVM02TM22000891 (Mytest) #
set allowaccess ping

FGVM02TM22000891 (Mytest) #
set interface port3

FGVM02TM22000891 (Mytest) #
set vlanid 111

FGVM02TM22000891 (Mytest) #
next

FGVM02TM22000891 (interface) #
end

FGVM02TM22000891 (root) #
end

FGVM02TM22000891 #
config global

FGVM02TM22000891 (global) #
get system status
Version: FortiGate-VM64-KVM v7.2.10,build1706,240918 (GA.M)
....... Output was cut
System time: Fri Oct 24 05:26:19 2025
Last reboot reason: warm reboot

FGVM02TM22000891 (global) #
execute reboot
This operation will reboot the system !
Do you want to continue? (y/n)
y^J

Possible debugs to take.

On FortiGate:

diagnose debug cli 8     
diagnose debug application fgfm 255
diagnose debug console timestamp enable

diagnose debug enable

On FortiManager:

diagnose debug application depmanager 255

diagnose debug application fgfm 255 <device name>

diagnose debug timestamp enable

diagnose debug enable